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Mission 

Our  mission  is  to  provide  independent,  relevant,  and  timely  oversight 
of  the  Department  of  Defense  that  supports  the  warfighter;  promotes 
accountability,  integrity,  and  efficiency;  advises  the  Secretary  of 
Defense  and  Congress;  and  informs  the  public. 


Vision 

Our  vision  is  to  be  a  model  oversight  organization  in  the  Federal 
Government  by  leading  change,  speaking  truth,  and  promoting 
excellence — a  diverse  organization,  working  together  as  one 
professional  team,  recognized  as  leaders  in  our  field. 


Fraud,  Waste  &  Abuse 

HOTLINE 

Department  of  Defense 

dodig.mil/hotlinel8oo.424.9098 


For  more  information  about  whistleblower  protection,  please  see  the  inside  back  cover. 


INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 

4800  MARK  CENTER  DRIVE 
ALEXANDRIA,  VIRGINIA  22350-1500 


May  14,  2015 


MEMORANDUM  FOR  DIRECTOR,  MISSILE  DEFENSE  AGENCY  OFFICE  OF  INTERNAL  REVIEW 

SUBJECT:  External  Peer  Review  Report  on  the  Missile  Defense  Agency  Office  of 
Internal  Review  (Report  No.  DODIG-2015-123) 

Attached  is  the  External  Peer  Review  Report  on  the  Missile  Defense  Agency  Office  of  Internal 
Review  conducted  in  accordance  with  Government  Auditing  Standards  and  the  Council  of 
the  Inspectors  General  on  Integrity  and  Efficiency  Guide  for  Conducting  Peer  Reviews  of  the 
Audit  Organizations  of  Federal  Offices  of  Inspector  General.  Your  response  to  the  draft  report  is 
included  as  Enclosure  2  with  excerpts  and  our  position  incorporated  into  the  relevant  sections 
of  the  report. 

We  appreciate  the  cooperation  and  courtesies  extended  to  our  staff  during  the  review. 


Randolph  R.  Stone 
Deputy  Inspector  General 
Policy  and  Oversight 


Attachments 
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INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 

4800  MARK  CENTER  DRIVE 
ALEXANDRIA,  VIRGINIA 22350-1 500 

May  14,  2015 

MEMORANDUM  FOR  DIRECTOR,  MISSILE  DEFENSE  AGENCY  OFFICE  OF  INTERNAL  REVIEW 
SUBJECT:  System  Review  Report  (Report  No.  DODIG-2015-123) 

We  have  reviewed  the  system  of  quality  control  for  the  Missile  Defense  Agency  Office  of 
Internal  Review  (MDA  OIR)  in  effect  for  the  year  ended  September  30,  2014.  A  system 
of  quality  control  encompasses  the  MDA  OIR’s  organizational  structure  and  the  policies 
adopted  and  procedures  established  to  provide  it  with  reasonable  assurance  of  conforming  to 
Government  Auditing  Standards  (GAS).  The  elements  of  quality  control  are  described  in  GAS. 
The  MDA  OIR  is  responsible  for  establishing  and  maintaining  a  system  of  quality  control  that 
is  designed  to  provide  it  with  reasonable  assurance  that  the  organization  and  its  personnel 
comply  with  professional  standards  and  applicable  legal  and  regulatory  requirements  in  all 
material  respects.  Our  responsibility  is  to  express  an  opinion  on  the  design  of  the  system 
of  quality  control  and  the  MDA  OIR’s  compliance  with  standards  and  requirements  based  on 
our  review. 

Our  review  was  conducted  in  accordance  with  GAS  and  the  Council  of  the  Inspectors  General 
on  Integrity  and  Efficiency  (CIGIE)  Guide  for  Conducting  Peer  Reviews  of  the  Audit  Organizations 
of  Federal  Offices  of  Inspector  General.  During  our  review,  we  interviewed  MDA  OIR  personnel 
and  obtained  an  understanding  of  the  nature  of  the  MDA  OIR’s  audit  organization  and  the 
design  of  its  system  of  quality  control  sufficient  to  assess  the  risks  implicit  in  its  audit 
function.  Based  on  our  assessments,  we  selected  audits,  nonaudit  services,  and  administrative 
files  to  test  for  conformity  with  professional  standards  and  compliance  with  the  MDA  OIR’s 
system  of  quality  control.  The  audits  selected  represented  a  reasonable  cross  section  of  the 
MDA  OIR’s  audit  organization,  with  emphasis  on  higher  risk  audits.  We  selected  nonaudit 
services  that  were  completed  during  our  review  period.  Prior  to  concluding  the  peer  review, 
we  reassessed  the  adequacy  of  the  scope  of  the  peer  review  procedures  and  met  with 
MDA  OIR’s  management  to  discuss  the  results  of  our  review.  We  believe  that  the  procedures 
we  performed  provide  a  reasonable  basis  for  our  opinion. 

In  performing  our  review,  we  obtained  an  understanding  of  the  system  of  quality  control 
for  the  MDA  OIR’s  audit  organization.  In  addition,  we  tested  compliance  with  the  MDA  OIR’s 
quality  control  policies  and  procedures  to  the  extent  that  we  considered  appropriate.  These 
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tests  covered  the  application  of  the  MDA  OIR's  policies  and  procedures  on  selected  audits.  Our 
review  was  based  on  selected  tests;  therefore,  it  would  not  necessarily  detect  all  weaknesses 
in  the  system  of  quality  control  or  all  instances  of  noncompliance  with  it. 

There  are  inherent  limitations  in  the  effectiveness  of  any  system  of  quality  control;  therefore, 
noncompliance  with  the  system  of  quality  control  may  occur  and  not  be  detected.  Projection 
of  any  evaluation  of  a  system  of  quality  control  to  future  periods  is  subject  to  the  risk  that  the 
system  of  quality  control  may  become  inadequate  because  of  changes  in  conditions,  or  because 
the  degree  of  compliance  with  the  policies  or  procedures  may  deteriorate. 

Enclosure  1  of  this  report  identifies  the  MDA  OIR  offices  that  we  visited  and  the  audits  and 
nonaudit  services  that  we  reviewed. 

We  noted  the  following  deficiencies  during  our  review. 

Deficiency  1 

MDA  OIR  Did  Not  Update  Nonaudit  Services  Policies 

During  December  2011,  the  Government  Accountability  Office  issued  revised  generally 
accepted  government  auditing  standards  (GAGAS),  which  were  effective  for  work 
beginning  on  or  after  December  15,  2011. 1  The  revision  contained  new  requirements  for 
assessing  and  documenting  potential  impairments  to  independence  for  nonaudit  services. 

MDA  Instruction  7600.05-INS,  “Internal  Review  Policies  and  Procedures,"  January  25,  2012 
states  that  the  document  will  be  reviewed  annually  from  the  initial  effective  date  and 
modified  to  reflect  any  changes  in  GAGAS  or  other  references  significantly  impacting  the 
policies  and  procedures  of  the  Instruction.  However,  the  January  25,  2012,  Instruction,  which 
superseded  the  April  2008  version,  did  not  include  guidance  on  conducting  nonaudit  services 
or  procedures  for  assessing  and  documenting  auditor  independence  for  nonaudit  services. 

DoD  Office  of  Inspector  General  (OIG)  Report,  DoDIG-2014-89,  “Implementation  of  2011 
Generally  Accepted  Government  Auditing  Standards  Independence  Standards  at  the  DoD  Audit 
Organizations,"  June  30,  2014,  recommended  that  the  Director,  MDA,  ensure  that  the  MDA  OIR 
create  internal  policies  and  procedures  detailing  how  nonaudit  service  requests  will  be 
assessed  and  documented  for  potential  impairments  to  independence.  The  Director  agreed 
with  the  recommendation  and  indicated  that  MDA  was  updating  its  internal  audit  policies 
and  procedures  for  assessing  and  documenting  potential  impairments  to  independence  for 
nonaudit  services.  The  estimated  completion  date  was  the  fourth  quarter  of  FY  2014. 


1  The  2011  Revision  of  GAGAS  is  effective  for  financial  audits  and  attestation  engagements  for  periods  ending  on  or  after 

December  15,  2012,  and  for  performance  audits  beginning  on  or  after  December  15,  2011.  Early  implementation  was  not  permitted. 
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The  MDA  OIR  audit  policies  in  effect  during  our  review  period  were  dated  January  25,  2012. 
During  our  review,  the  MDA  OIR  provided  us  with  a  draft  update  dated  October  10,  2014,  and 
a  subsequent  final  draft  update  dated  November  24,  2014,  both  of  which  were  intended  to 
supersede  the  January  25,  2012,  version.  We  evaluated  the  November  24,  2014,  version  and 
provided  suggested  changes  to  the  MDA  OIR.  However,  we  used  the  January  25,  2012,  version 
when  evaluating  MDA  OIR’s  system  of  quality  control  because  it  was  effective  during  our 
review  period. 

On  March  25,  2015,  MDA  OIR  issued  policy  guidance  in  the  form  of  a  Standard  Operating 
Procedure  (SOP)  on  accepting  and  performing  nonaudit  services.  This  guidance  corrected  this 
deficiency;  therefore,  there  is  no  recommendation. 

Deficiency  2 

MDA  OIR  Performed  and  Reported  Nonaudit  Services  as 
Special  Projects 

GAS  2.12  states  it  does  not  cover  nonaudit  services,  which  are  defined  as  professional  services 
other  than  audits  or  attestation  engagements.  GAS  3.34  states  that  before  an  auditor  agrees 
to  perform  a  nonaudit  service  of  an  audited  entity,  the  auditor  should  determine  whether 
providing  such  a  service  would  create  a  threat  to  independence,  either  by  itself  or  in  the 
aggregate  with  other  nonaudit  services  provided,  with  respect  to  any  GAGAS  audit  it  performs. 
MDA  Instruction  7600.05-INS  did  not  contain  guidance  on  conducting  nonaudit  services  or 
evaluating  auditor  independence  when  conducting  nonaudit  services.  Instead,  the  Instruction 
provided  guidance  on  conducting  special  projects,  which  are  considered  nonaudit  services 
under  GAGAS. 

The  Instruction  defined  special  projects  as: 

Special  projects  are  initiated  on  an  as  needed  basis  or  special  request 
from  authorized  individuals  within  the  Agency.  Internal  Review  provides 
quick  reaction  non-GAGAS  audits  as  requested.  Special  projects  do  not 
always  require  a  formal  audit  report,  but  results  are  provided  in  a  timely 
manner  to  relevant  MDA  officials. 

MDA  OIR’s  use  of  the  term  "special  projects”  incorrectly  represented  the  type  of  work 
performed  when  results  of  the  nonaudit  services  were  reported  to  MDA  officials.  The 
Instruction  did  not  include  policies  and  procedures  for  staff  to  follow  when  directed 
to  conduct  nonaudit  services.  Additionally,  the  absence  of  policies  and  procedures  for 
conducting  nonaudit  services  and  assessing  auditor  independence  increased  the  potential 
for  noncompliance  with  GAGAS  independence  standards. 
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On  March  25,  2015,  MDA  OIR  issued  policy  guidance  in  the  form  of  an  SOP  on  conducting 
nonaudit  services  and  evaluating  auditor  independence.  This  guidance  corrected  this 
deficiency.  However,  training  should  be  obtained  to  better  understand  the  policies  for 
conducting  nonaudit  services. 

Recommendation 

The  Director,  MDA  OIR  should  provide  training  for  managers  on  nonaudit  services 
and  the  application  of  the  conceptual  framework  for  independence  in  order  to  comply 
with  GAGAS. 

Management  Comments 

The  Director,  MDA  OIR  concurred  with  the  recommendation  and  stated  that  the  MDA  OIR 
staff  will  receive  training  on  nonaudit  services  and  the  application  of  the  conceptual 
framework  from  the  DoD  OIG  in  the  3rd  quarter,  FY  2015. 

Our  Response 

The  MDA  OIR  comments  met  the  intent  of  the  recommendation.  No  further  response 
is  required. 

Deficiency  3 

MDA  OIR  Did  Not  Document  GAGAS  Independence  Requirements  for 
Nonaudit  Services 

GAS  3.34  provides  the  following  independence  requirements  for  conducting  nonaudit  services. 

Before  an  auditor  agrees  to  provide  a  nonaudit  service  to  an  audited 
entity,  the  auditor  should  determine  whether  providing  the  service 
would  create  a  threat  to  independence,  either  by  itself  or  in  aggregate 
with  other  nonaudit  services  provided,  with  respect  to  any  GAGAS  audit 
it  performs.  A  critical  component  of  this  determination  is  consideration 
of  management’s  ability  to  effectively  oversee  the  nonaudit  service  to 
be  performed.  The  auditor  should  determine  that  the  audited  entity 
has  designated  an  individual  who  possesses  suitable  skill,  knowledge, 
or  experience,  and  that  the  individual  understands  the  services  to  be 
performed  sufficiently  to  oversee  them.  The  auditor  should  document 
consideration  of  management’s  ability  to  effectively  oversee  nonaudit 
services  to  be  performed. 

For  five  of  the  nonaudit  services  reviewed,  the  MDA  OIR  could  not  provide  documentation  of 
its  independence  analysis  or  consideration  of  management’s  ability  to  oversee  the  nonaudit 
services  performed. 
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GAS  3.39  states  auditors  should  establish  and  document  their  understanding  with  the  audited 
entity  for  which  the  auditors  will  perform  a  nonaudit  service.  For  three  of  the  five  nonaudit 
services  reviewed,  the  MDA  OIR  could  not  provide  documentation  for: 

•  audited  entity’s  acceptance  of  its  responsibilities;  and 

•  the  auditor’s  responsibilities. 

GAS  3.59  states  although  insufficient  documentation  of  an  auditor’s  compliance  with  the 
independence  standard  does  not  impair  independence,  appropriate  documentation  is 
required  under  GAGAS  quality  control  and  assurance  requirements.  The  MDA  OIR’s  lack  of 
independence  documentation  for  GAGAS  nonaudit  services  indicated  a  weakness  in  its  system 
of  quality  control  and  assurance.  Further,  the  absence  of  required  documentation  could 
potentially  cause  noncompliance  with  GAGAS  nonaudit  services  independence  standards. 

On  March  25,  2015,  MDA  OIR  issued  policy  guidance  in  the  form  of  an  SOP  on  documenting  the 
independence  requirements  for  nonaudit  services.  This  guidance  corrected  this  deficiency; 
therefore,  there  is  no  recommendation. 

Deficiency  4 

MDA  OIR  Was  Not  Annually  Monitoring  Quality 

MDA  OIR  has  not  been  performing  the  annual  monitoring  of  quality  requirement. 

GAS  3.95  states: 

The  audit  organization  should  analyze  and  summarize  the  results  of  its 
monitoring  process  at  least  annually,  with  identification  of  any  systemic 
or  repetitive  issues  needing  improvement,  along  with  recommendations 
for  corrective  action.  The  audit  organization  should  communicate  to 
appropriate  personnel  any  deficiencies  noted  during  the  monitoring 
process  and  make  recommendations  for  appropriate  remedial  action. 

During  the  period  of  our  review,  it  was  determined  that  the  MDA  OIR  has  not  been  performing 
the  annual  monitoring  of  quality. 

On  March  25,  2015,  MDA  OIR  issued  policy  guidance  in  the  form  of  an  SOP  on  quality 
assurance,  and  procedures  for  annual  monitoring  of  quality  was  contained  within  this 
guidance.  This  guidance  corrected  this  deficiency;  therefore,  there  is  no  recommendation. 


DODIG-2015-123  |  5 


Deficiency  5 

MDA  OIR  Audit  Reports  Did  Not  Include  Views  of  Responsible  Officials 
and  the  Auditors'  Evaluation  of  That  Information 

MDA  OIR  auditors  did  not  include  management  comments  in  all  four  audit  reports  reviewed. 
They  also  did  not  include  their  evaluation  of  that  information. 

GAS  7.32  states  that  auditors  should  obtain  and  report  the  views  of  responsible  officials  of 
the  audited  entity  concerning  the  findings,  conclusions,  and  recommendations  included  in  the 
audit  report,  as  well  as  any  planned  corrective  actions.  GAS  7.33  states  that  including  the 
responsible  officials’  views  results  in  a  report  that  presents  not  only  the  auditors’  findings, 
conclusions,  and  recommendations,  but  also  the  perspectives  of  the  responsible  officials  of  the 
audited  entity  and  the  corrective  actions  they  plan  to  take. 

GAS  7.34  further  states  that  when  auditors  receive  written  comments  from  the  responsible 
officials,  they  should  include  in  their  report  a  copy  of  the  officials’  written  comments,  or  a 
summary  of  the  comments  received.  Finally,  GAS  7.35  states  that  auditors  should  also  include 
in  the  report  an  evaluation  of  the  comments,  as  appropriate. 

Additionally,  MDA  Instruction  7600.05-INS,  Enclosure  3,  "IR  Procedures,"  paragraph  3c(l) 
states,  "Issue  a  final  audit  report  containing  the  audited  organization’s  formal  response  and 
IR’s  evaluation  of  the  response,  with  a  formal  request  to  the  D2  for  approval.” 

The  current  process  for  handling  management  comments  on  the  draft  report  is  the 
MDA  OIR  creates  a  Staff  Summary  Sheet3  for  routing  to  the  Director,  MDA,  which  includes 
three  attachments:  the  final  audit  report,  management’s  comments  on  the  draft  report,  and 
a  corrective  action  plan.  However,  management  comments  were  not  summarized  in  the 
final  report. 

As  of  February  27,  2015,  the  MDA  OIR  has  begun  including  the  views  of  responsible  officials 
and  the  auditors’  evaluation  of  that  information  in  their  audit  reports.  This  action  corrected 
this  deficiency;  therefore,  there  is  no  recommendation. 

Enclosure  2  of  this  report  includes  MDA  OIR’s  response  to  the  draft  report. 

In  our  opinion,  except  for  the  deficiencies  described  above,  the  system  of  quality  control  for 
the  audit  organization  of  the  MDA  OIR  in  effect  for  the  year  ended  September  30,  2014,  has 


2  The  "D"  stands  for  Director  of  MDA. 

3  A  Staff  Summary  Sheet  is  an  internal  routing  document  that  serves  as  a  record  for  internal  coordination  and  summary  of  actions. 
It  is  used  to  present  a  position  to  a  senior  official  for  approval  or  disapproval. 
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been  suitably  designed  and  complied  with  to  provide  the  MDA  OIR  with  reasonable  assurance 
of  performing  and  reporting  in  conformity  with  applicable  professional  standards  in  all 
material  respects.  Audit  organizations  can  receive  a  rating  of  pass,  pass  with  deficiencies,  or 
fail.  The  MDA  OIR  has  received  an  External  Peer  Review  rating  of  pass  with  deficiencies.  As  is 
customary,  we  have  issued  a  letter  dated  May  14,  2015  that  sets  forth  findings  that  were  not 
considered  to  be  of  sufficient  significance  to  affect  our  opinion  expressed  in  this  report. 


Randolph  R.  Stone 
Deputy  Inspector  General 
Policy  and  Oversight 


Enclosures 
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Enclosure  1 


Scope  and  Methodology 

We  tested  compliance  with  the  MDA  OIR’s  system  of  quality  control  to  the  extent  we 
considered  appropriate.  These  tests  included  a  review  of  4  of  14  audit  reports  issued  during 
the  period  October  1,  2012,  through  September  30,  2014.  Table  1  lists  the  audit  reports 
reviewed.  In  addition,  we  tested  GAGAS  and  MDA  OIR  policy  compliance  for  nonaudit  services 
and  continuing  professional  education  hours.  Table  2  lists  the  nonaudit  services  reviewed. 

We  were  unable  to  review  any  internal  quality  control  reviews  because  the  MDA  OIR  did 
not  perform  any  such  reviews.  In  addition,  we  interviewed  personnel  to  determine  their 
understanding  of  and  compliance  with  quality  control  policies  and  procedures.  Finally,  we 
reviewed  MDA  OIR  audit  policies  and  procedures  that  were  published  on  January  25,  2012. 

We  visited  the  MDA  OIR  sites  located  in  Fort  Belvoir,  VA  and  Huntsville,  AL. 


Table  1.  Reviewed  Audits  Performed  by  MDA  OIR 


Audit  Title 

Date  Audit  Was  Announced 

Report  Number  and 
Issuance  Date 

Type  of  Review 

Travel  Card  Management  and 
Temporary  Duty 

March  1,  2013 

A-13-05, 

April  2,  2014 

Performance 

Missile  Defense  Agency's 

Service  Contracts 

April  9,  2013 

A-13-09, 

July  29,  2014 

Performance 

Ballistic  Missile  Defense 

System  Packing,  Handling,  and 

Storage  Operations 

August  28,  2013 

A-13-12, 

March  26,  2014 

Performance 

Depot  Maintenance  Reporting 

Formal  Announcement  Memo 

Not  Issued;  however,  an  E-Tasker 
dated  February  28,  2014, 
informed  MDA  management  of 
the  upcoming  audit. 

A-14-04, 

September  22,  2014 

Performance 

DODIG-2015-123 


Table  2.  Reviewed  Special  Projects  (Nonaudit  Services)  Performed  by  MDA  OIR 


Project  Number/Title 

Beginning  Date 

Report  Date 

Deliverable 

MDA 

Project  Type* 

P-12-03  MDA  Certification 
Process  of  External 

Training  Completion 

July  17,  2012 

January  15,  2013 

Memorandum  Report 

Evaluation 

P-12-04  Intragovernmental 
Trading  Partners 

July  23,  2012** 

January  17,  2013 

Memorandum  Report 

Assessment 

P-12-04-01  Follow  On, 
Intragovernmental 

Trading  Partners 

February  14,  2013 

June  20,  2013 

Memorandum  Report 

Assessment 

P-12-05  Full-up  Transport, 
Special  Project 

August  30,  2012 

January  28,  2013 

Memorandum  Report 

Review 

P-12-06  Special  Project 
for  Director,  Technical 
Intelligence/Special  Program 
Administration  (DEI) 

May  1,  2012 

November  1,  2012 

Briefing  Slides 

Special  Project 

All  deliverables  contained  the  words  "special  project"  in  the  memorandum  report  or  briefing  slides.  Project  numbers  P-12-03,  P-12-04,  P-12-04-01, 
and  P-12-05  contained  additional  descriptive  information  regarding  the  work  performed  in  either  the  memo  report  title  or  report  body. 


The  MDA  OIR  indicated  that  the  reviewers  should  use  July  23,  2012,  as  the  beginning  date  for  both  P-12-04  and  P-12-04-01  (the  follow  on  project). 
However,  we  used  the  beginning  date  of  February  14,  2013,  for  the  follow  on  project  because  that  is  the  date  of  the  announcement  memo. 
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Enclosure  2 


Management  Comments 

DEPARTMENT  OF  DEFENSE 

MISSILE  DEFENSE  AGENCY 
5700  IS™ STREET 

FORT  BELVOIR,  VIRGINIA  220605573 

April  24.  2015 

MEMORANDUM  FOR  DEPUTY  INSPECTOR  GENERAL,  POLICY  AND  OVER  ISO  HT 

DEPARTMENT  OF  DEFENSE  OFFICE  OF  INSPECTOR  GENERAL 

SUBJECT:  Response  to  Department  of  Defense  Inspector  General  (DoD  IG) 

Thank  yon  for  giving  the  Missile  Defense  Agency  (ML) A)  Interna!  Review  (1R)  the 

opportunity  to  review  and  provide  comments  to  the  draft  report  for  Project  D2015-DAPQIA- 

0024.000,  “Quality  Control  of  the  MDA  Internal  Review  Function."  IR  comments  follow: 

DoDlG  Recommendation;  T  he  Director.  MDA  IR  should  provide  training  for  mangers  on  non- 

audit  services  and  the  application  of  the  conceptual  framework  for  independence  in  order  to 

comply  with  Generally  Accepted  Government  Auditing  Standards  (GAGAS). 

MDA  Response  to  Recommendation:  Concur.  MDA  IR  will  receive  training  from  the  DoD 

IG  on  performing  non-audit  services  and  the  application  of  the  conceptual  framework.  T  he 

estimated  completion  date  Is  FY 1 5  third  quarter. 


Robert  N.  Weyant  Jr. 

Director j  MDA  internal  Review 
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INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 

4800  MARK  CENTER  DRIVE 
ALEXANDRIA,  VIRGINIA  22350-1500 


May  14,  2015 


MEMORANDUM  FOR  DIRECTOR,  MISSILE  DEFENSE  AGENCY  OFFICE  OF  INTERNAL  REVIEW 
SUBJECT:  Letter  of  Comment  (Report  No.  DODIG-2015-123) 

We  have  reviewed  the  system  of  quality  control  for  the  Missile  Defense  Agency  Office  of 
Internal  Review  (MDA  OIR)  in  effect  for  the  year  ended  September  30,  2014,  and  have  issued 
our  final  report  on  May  14,  2015,  in  which  the  MDA  OIR  received  a  rating  of  pass  with 
deficiencies.  The  system  review  report  should  be  read  in  conjunction  with  the  comment 
in  this  letter,  which  was  considered  in  determining  our  opinion.  The  finding  described 
below  was  not  considered  to  be  of  sufficient  significance  to  affect  the  opinion  expressed  in 
the  report. 

Finding.  The  MDA  OIR  Was  Not  Signing  and  Dating  Final  Reports 

The  MDA  OIR  issues  final  and  memorandum  reports.  While  they  were  signing  and  dating  the 
memorandum  reports,  the  MDA  OIR  was  not  signing  and  dating  its  final  reports.  Signing  and 
dating  final  reports  is  not  specifically  required  by  generally  accepted  government  auditing 
standards;  however,  it  is  our  opinion,  and  a  leading  practice,  that  final  reports  issued  by 
an  audit  organization  should  be  signed  and  dated  by  the  head  of  the  audit  organization  or 
an  appropriately  designated  individual.  As  of  February  27,  2015,  the  MDA  OIR  had  begun 
signing  and  dating  its  final  reports.  This  action  corrected  this  finding;  therefore,  there  is 
no  recommendation. 


Randolph  R.  Stone 
Deputy  Inspector  General 
Policy  and  Oversight 
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Whistleblower  Protection 
U.S.  Department  of  Defense 


The  Whistleblower  Protection  Enhancement  Act  of  2012  requires 
the  Inspector  General  to  designate  a  Whistleblower  Protection 
Ombudsman  to  educate  agency  employees  about  prohibitions 
on  retaliation,  and  rights  and  remedies  against  retaliation  for 
protected  disclosures.  The  designated  ombudsman  is  the  DoD  Hotline 
Director.  For  more  information  on  your  rights  and  remedies  against 
retaliation,  visit  www.dodig.mil/programs/whistleblower. 


For  more  information  about  DoD  IG 
reports  or  activities,  please  contact  us: 

Congressional  Liaison 

congressional@dodig.mil;  703.604.8324 

Media  Contact 

public.affairs@dodig.mil;  703.604.8324 

Monthly  Update 

dodigconnect-request@listserve.com 

Reports  Mailing  List 

dodig_report@listserve.com 

Twitter 

twitter.com/DoD_IG 

DoD  Hotline 

dodig.mil/hotline 


